{"id":"EUVD-2026-42105","revision":null,"records":[{"revision":"bcbccfbccba646a384cd526f6a244362","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49229","aliases":[],"title":"Actual: Disabled OpenID users keep access through existing session tokens","description":"Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.","state":0,"publishedAt":"2026-07-07T20:59:34.173+00:00","modifiedAt":"2026-07-09T13:56:02.796+00:00","affected":[{"ecosystem":"Vendor product","name":"actual","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"actualbudget\",\n                    \"product\": \"actual\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 26.6.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":"HIGH"}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg","https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80","https://github.com/actualbudget/actual/releases/tag/v26.6.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49229","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49229","identifiers":["CVE-2026-49229"]},"retained":false,"historicalAffected":[]},{"revision":"fb5296ac86354c9e809db0df8a384700","observedAt":"2026-11-07T11:31:08.922+00:00","statement":{"source":"euvd","id":"EUVD-2026-42105","aliases":["CVE-2026-49229","GHSA-cq9c-6w48-qmfg"],"title":"Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The share…","description":"Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":null}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg","https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80","https://github.com/actualbudget/actual/releases/tag/v26.6.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42105","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 7, 2026, 8:59:34 PM","dateUpdated":"Jul 9, 2026, 1:56:02 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42105","identifiers":["EUVD-2026-42105","CVE-2026-49229","GHSA-cq9c-6w48-qmfg"]},"retained":false,"historicalAffected":[]},{"revision":"4a3cf1fa24a742358e14680d86ff1654","observedAt":"2026-10-27T13:11:53.172+00:00","statement":{"source":"nvd","id":"CVE-2026-49229","aliases":[],"title":"Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The share…","description":"Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled user to continue calling authenticated server endpoints. This issue is fixed in version 26.6.0.","state":0,"publishedAt":"2026-07-07T22:16:52.78+00:00","modifiedAt":"2026-10-25T20:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3,"severity":"HIGH"}],"references":["https://github.com/actualbudget/actual/commit/c8cb8a223a4faf1c2e1dcb0795a79a93f7b19e80","https://github.com/actualbudget/actual/releases/tag/v26.6.0","https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49229","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-613"],"productCriteria":[],"sourceDates":{"published":"2026-07-07T22:16:52.780","lastModified":"2026-10-25T20:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-49229","identifiers":["CVE-2026-49229"]},"retained":false,"historicalAffected":[]},{"revision":"b3370e3817684d1990a27dd1a278f70a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-cq9c-6w48-qmfg","aliases":["CVE-2026-49229"],"title":"@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens","description":"### Summary\n\nIn OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.\n\n### Details\n\nThe disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has `enabled = 1`, and a disabled row causes the OpenID grant to fail before a new session token is created.\n\n```ts\n// packages/sync-server/src/accounts/openid.ts:284-291\nconst { id: userIdFromDb, display_name: displayName } =\n  accountDb.first(\n    'SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1',\n    [identity],\n  ) || {};\n\nif (userIdFromDb == null) {\n  throw new Error('openid-grant-failed');\n}\n```\n\nThe shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by `validateSessionMiddleware`.\n\n```ts\n// packages/sync-server/src/util/validate-user.ts:10-41\nexport function validateSession(req: Request, res: Response) {\n  let { token } = req.body || {};\n  if (!token) {\n    token = req.headers['x-actual-token'];\n  }\n\n  const session = getSession(token);\n  ...\n  return session;\n}\n```\n\nThis means account disablement and session authorization diverge:\n\n```text\nOpenID login path: users.enabled must be 1\nExisting session path: token exists and is not expired; users.enabled is not checked\n```\n\nThe default token expiration setting is `never`, so this is not just a short race after disablement on default deployments.\n\n```js\n// packages/sync-server/src/load-config.js:260-264\ntoken_expiration: {\n  doc: 'Token expiration time.',\n  format: 'tokenExpiration',\n  default: 'never',\n  env: 'ACTUAL_TOKEN_EXPIRATION',\n},\n```\n\nAdmins can change a user's enabled state through the user update route, but that update does not delete the user's existing sessions. After the update, the old token still satisfies `validateSession`.\n\n```js\n// packages/sync-server/src/app-admin.js:91-101\napp.patch('/users', validateSessionMiddleware, async (req, res) => {\n  if (!isAdmin(res.locals.user_id)) {\n    ...\n  }\n\n  const { id, userName, role, displayName, enabled } = req.body || {};\n```\n\n```ts\n// packages/sync-server/src/services/user-service.ts:98-102\ngetAccountDb().mutate(\n  'UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?',\n  [userName, displayName, enabled, roleId, userId],\n);\n```\n\nAuthenticated server features then continue to trust that session. For example, the sync API installs `validateSessionMiddleware` for the whole router, so a disabled user can keep using any sync operation that their still-valid session and existing file ownership/access allow.\n\n```ts\n// packages/sync-server/src/app-sync.ts:37-39\nconst app = express();\napp.use(validateSessionMiddleware);\napp.use(errorMiddleware);\n```\n\nThis is distinct from the previously published cross-user sync authorization issue: the attacker does not need to access another user's file ID. The bypass is that a disabled user's own session remains authorized after account disablement.\n\n### PoC\n\n1. Run an Actual Sync Server in OpenID multi-user mode with `@actual-app/sync-server` 26.5.0. Use the default token expiration setting, or any setting where the token has not expired yet.\n2. Log in as a non-admin OpenID user and save the returned Actual session token.\n3. As an admin, disable that same user through `PATCH /admin/users` by sending `enabled: false`.\n4. Reuse the old token against a protected endpoint.\n\nExample success check:\n\n```bash\ncurl -s https://actual.example.com/account/validate \\\n  -H 'X-Actual-Token: <disabled_user_existing_token>'\n```\n\nExpected result on the affected code path: the request is still treated as authenticated and returns the disabled user's account/session information instead of `401` or `403`.\n\nA sync-facing check uses the same session validation primitive:\n\n```bash\ncurl -s https://actual.example.com/sync/list-user-files \\\n  -H 'X-Actual-Token: <disabled_user_existing_token>'\n```\n\nExpected result on the affected code path: the disabled user can still list and operate on budget files that the stale session is otherwise allowed to access.\n\n### Impact\n\nA disabled OpenID user can keep post-authentication access until the session row is deleted or expires. With the default `token_expiration: never`, this can persist indefinitely.\n\nFor a disabled basic user, the confirmed impact is continued access to that user's own budgets and any budgets shared with that user, including sensitive financial data and allowed mutations. For a disabled admin user, the impact is broader because the existing token can still satisfy admin role checks; that condition preserves administrative access after the account was disabled.\n\nThe missing rule is that session validation should reject disabled users, and disabling or deleting a user should revoke that user's existing sessions.","state":0,"publishedAt":"2026-06-22T23:19:56+00:00","modifiedAt":"2026-09-10T03:51:08.4775915+00:00","affected":[{"ecosystem":"npm","name":"@actual-app/sync-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"26.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg","https://github.com/actualbudget/actual"],"sourceUrl":"https://github.com/advisories/GHSA-cq9c-6w48-qmfg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cq9c-6w48-qmfg","identifiers":["GHSA-cq9c-6w48-qmfg","CVE-2026-49229"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}